Systems and methods for threat response in computer environments can include detecting, by one or more processors, a threat to the computer environment, and identifying a subset of assets of the plurality of assets associated with the threat. The one or more processors can determine from a predefined set of resolutions a plurality of resolutions executable to resolve the threat for the subset of assets. The one or more processors can execute, for each resolution of the plurality of resolutions, a trained model to simulate the resolution for the subset of assets. The one or more processors can select, based at least on results of execution of each resolution, a resolution among the plurality of resolutions to be implemented.